Google Chrome EUVD-2026-65805

Exploitation requires a Windows user to be running Google Chrome prior to version 152.0.7977.65 and to visit an attacker-controlled or compromised web page - no special Chrome configuration, plugin, or feature enablement is needed beyond the default browser state. CVSS PR:N confirms no authentication is required from the attacker's side; CVSS UI:R confirms the victim must actively visit the malicious page (e.g., click a link). Exploitation is platform-specific to Windows, as the description explicitly scopes the flaw to Chrome on Windows - likely tied to ANGLE's Direct3D translation path. The unchanged scope (S:U) means successful exploitation is bounded to the Chrome GPU sandbox process; achieving OS-level or cross-process impact would require chaining with a separate sandbox escape vulnerability, which is not described in available data.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) characterizes this as a high-severity, low-complexity, network-delivered vulnerability requiring only a single user interaction - visiting a web page. However, the unchanged scope (S:U) is a meaningful limiting factor: successful exploitation is contained to Chrome's GPU sandbox process and does not directly affect the underlying OS without a separate sandbox escape. The EPSS score of 0.42% at the 35th percentile is notably low relative to the CVSS score, suggesting that despite theoretical severity, technical barriers to reliable exploitation (e.g., ASLR, sandbox hardening, heap randomization) are suppressing real-world weaponization. No CISA KEV listing exists and no public POC has been identified, meaning this is currently a patch-priority rather than an incident-response situation. The low EPSS diverges from the high CVSS, a common pattern for memory-corruption browser bugs where writing a reliable exploit is difficult - organizations should prioritize patch deployment but need not treat this as an active compromise scenario. No conflicting signals exist between CVSS vector and description: both indicate network-delivered, user-interaction-required exploitation.

An attacker crafts an HTML page containing malicious WebGL or GPU-rendering content designed to trigger the out-of-bounds write within ANGLE's Direct3D translation layer on Windows. A user running an unpatched Chrome version navigates to the page - via a phishing link, malvertising, or a compromised website - causing memory corruption in Chrome's GPU process and potentially enabling arbitrary code execution within the sandbox. No public exploit code has been identified at time of analysis, meaning exploitation currently requires significant reverse-engineering effort and deep knowledge of ANGLE's internals.